Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2018-12-31 15:23:26	2018-12-31 15:26:18	172 seconds	1.2

File Details

File name

1c4e357a8ec5f13de4ffd57cc2711afe.apk

File size

3732036 bytes

File type

Java archive data (JAR)

CRC32

304B95CB

MD5

1c4e357a8ec5f13de4ffd57cc2711afe

SHA1

2618cf66aac4ea053bcecf5afc3f2d3584d099c6

SHA256

f9bf78083c66f52875990ff39e3aeab5bb04bb6c61cefed0d2a1dd5e02f34ada

SHA512

42fb9d45f99615200abd96f93fa6e5c6daa962e2f3ab539b5572901123a92e3d5b7f32cce37a59dafbf32ceffbd2421b7e90aef5fd5c9ec503dd5748872f2afa

Ssdeep

None

PEiD

None matched

Yara

shellcode (Matched shellcode byte patterns)

VirusTotal

Permalink
VirusTotal Scan Date: 2017-05-29 09:10:24
Detection Rate: 29/58 (Expand)

Antivirus	Version	Result
Ad-Aware	3.0.3.1010	Android.Adware.Dowgin.I
AegisLab	4.2	Clean
AhnLab-V3	3.9.0.17697	Android-PUP/Dowgin.91b2
Alibaba	1.0	Clean
ALYac	1.0.1.9	Clean
Arcabit	1.0.0.806	Android.Adware.Dowgin.I
Avast	8.0.1489.320	Clean
AVG	16.0.0.4776	Android/G2P.JS.FABC303AB470
Avira	8.3.3.4	Clean
AVware	1.5.0.42	Clean
Baidu	1.0.0.2	Android.Trojan.MTK.n
BitDefender	7.2	Android.Adware.Dowgin.I
Bkav	1.3.0.8876	Android.Malware.SDi.54D8
CAT-QuickHeal	14.00	Android.Dowgin.N (AdWare)
ClamAV	0.99.2.0	Clean
CMC	1.1.0.977	Clean
Comodo	27178	Clean
Cyren	5.4.30.7	AndroidOS/Dowgin.B.gen!Eldorado
DrWeb	7.0.28.2020	Android.DownLoader.1906
Emsisoft	4.0.0.834	Android.Adware.Dowgin.I (B)
ESET-NOD32	15493	a variant of Android/AdDisplay.Dowgin.AF potentially unwanted
F-Prot	4.7.1.166	AndroidOS/Dogwin.K
F-Secure	11.0.19100.45	Adware:Android/Dowgin
Fortinet	5.4.233.0	Adware/Dowgin!Android
GData	A:25.12614B:25.9641	Android.Adware.Dowgin.I
Ikarus	0.1.5.2	PUA.AndroidOS.AdDisplay
Jiangmin	16.0.100	Clean
K7AntiVirus	10.14.23481	Clean
K7GW	10.14.23479	Clean
Kaspersky	15.0.1.13	not-a-virus:HEUR:AdWare.AndroidOS.Ewind.e
Kingsoft	2013.8.14.323	Clean
Malwarebytes	2.1.1.1115	Clean
McAfee	6.0.6.653	Artemis!1C4E357A8EC5
McAfee-GW-Edition	v2015	Artemis
Microsoft	1.1.13804.0	Ransom:AndroidOS/LockScreen!rfn
MicroWorld-eScan	12.0.250.0	Android.Adware.Dowgin.I
NANO-Antivirus	1.0.76.17180	Trojan.Android.Dowgin.dgswlz
nProtect	2017-05-29.02	Clean
Panda	4.6.4.2	Clean
Qihoo-360	1.0.0.1120	Adware.Android.Gen
Rising	28.0.0.1	Clean
Sophos	4.98.0	Android Dowgin (PUA)
SUPERAntiSpyware	5.6.0.1032	Clean
Symantec	1.3.1.0	Clean
SymantecMobileInsight	1.0.0.35_220	AdLibrary:Feiwo
Tencent	1.0.0.1	Win32.Risk.Adware.Dzas
TheHacker	6.8.0.5.1576	Clean
TotalDefense	37.1.62.1	Clean
TrendMicro-HouseCall	9.900.0.1004	Clean
VBA32	3.12.26.4	Clean
VIPRE	58432	Clean
ViRobot	2014.3.20.0	Clean
Webroot	1.0.0.207	Clean
WhiteArmor	9101275	Malware.HighConfidence
Yandex	5.5.1.3	Clean
Zillya	2.0.0.3292	Clean
ZoneAlarm	1.0	not-a-virus:HEUR:AdWare.AndroidOS.Ewind.e
Zoner	1.0	Clean

Android Application Info

Package	com.sdfge.wty
Main Activity	hugh.android.app.common.SplashActivity

Activities

Activity Name
hugh.android.app.cheng.ChengYuActivity
hugh.android.app.common.SplashActivity
hugh.android.app.cheng.ChengYuListActivity
hugh.android.app.cheng.FActivity
hugh.android.app.cheng.A
hugh.android.app.common.SetActivity
net.p.y.a
com.b.y.ia
com.b.y.la
com.fivefeiwo.coverscreen.SA
com.fivefeiwo.coverscreen.WA
com.soaplale.plalecap.Tb
com.upssjc.oybnjhwe.Cb
com.schooler.yunc.LmuCA
com.tuyou.peng.PauA
com.xiaomile.cmber.CerA
com.xiaomile.tmber.BerA
com.xiaomile.ccmber.CcerA

Services

Service Name
com.umeng.common.net.DownloadingService
cn.c.y.f
com.soaplale.plalecap.Td
com.upssjc.oybnjhwe.Cc
com.tuyou.peng.PuangS
com.xiaomile.tmber.BerS

Receivers

Receiver Action
android.intent.action.USER_PRESENT
com.lseiei.downloadManager
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_ADDED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT
com.lseiei.downloadManager
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.net.conn.CONNECTIVITY_CHANGE
com.lseiei.downloadManager
android.intent.action.USER_PRESENT
android.intent.action.USER_PRESENT
com.lseiei.downloadManager
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT
broadcast.route.control
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT
android.intent.action.PACKAGE_ADDED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.USER_PRESENT
android.intent.action.PACKAGE_ADDED
android.net.conn.CONNECTIVITY_CHANGE

Permissions

Signatures

File has been identified by at least one AntiVirus on VirusTotal as malicious (Osint)

Application Contains Shared Object Files (Static)

Performs some HTTP requests

Umeng Adware (Detection)

Application Asks For Dangerous Permissions (Static)

File has been identified by more the 10 AntiVirus on VirusTotal as malicious (Osint)

Hidden Payload Found (Static)

Application Contains APK (Static)

Android Dynamic Analysis

Shell Commands

Queried Accounts

Dynamically Loaded Files

SMS Messages

Registered Broadcast Receivers

Crypto Keys

Encryption Plaintext

Content Resolver Queries

Intents

Reflection Calls

Fingerprints

Content Observers

Shared Preferences

Content Values

Telephone State Listen

Files Accessed By Application

System Properties

Android Static Analysis

Screenshots

Network Analysis

Hosts Involved

IP Address
ff02::16
ff02::1:ff12:3456
ff02::2
103.18.128.60
103.235.46.68
121.46.3.168
203.119.128.99
211.144.132.59
211.144.132.60

DNS Requests

Domain	IP Address
csapi.adfeiwo.com
api.map.baidu.com	103.235.46.68
ad.veegao.com
api.cp.guiji.com	211.144.132.60
ad.lanjingke.com	121.46.3.168
zp.veegao.com
2.android.pool.ntp.org	103.18.128.60
alog.umeng.com	203.119.128.15

HTTP Requests

URL	Data
http://api.cp.guiji.com/is/info.jsp	POST /is/info.jsp HTTP/1.1 Content-Length: 539 Content-Type: application/x-www-form-urlencoded Host: api.cp.guiji.com Connection: Keep-Alive
http://alog.umeng.com/app_logs	POST /app_logs HTTP/1.1 X-Umeng-Sdk: Android/4.5 %E6%96%B0%E7%BC%96%E6%88%90%E8%AF%AD%E8%AF%8D%E5%85%B8%2F3.8+sdk%2F4.1.2+528447f4ffb4e4824a2fd1d1f0cd62 Content-Encoding: deflate Content-Length: 435 Host: alog.umeng.com Connection: Keep-Alive
http://ad.lanjingke.com/lanjingke/cp.action?requestId=0&g=1	POST /lanjingke/cp.action?requestId=0&g=1 HTTP/1.1 Content-Length: 300 Host: ad.lanjingke.com Connection: Keep-Alive User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4)
http://api.cp.guiji.com/push/info.jsp	POST /push/info.jsp HTTP/1.1 Content-Length: 969 Content-Type: application/x-www-form-urlencoded Host: api.cp.guiji.com Connection: Keep-Alive
http://ad.lanjingke.com/lanjingke/iris.action?g=1	POST /lanjingke/iris.action?g=1 HTTP/1.1 Content-Length: 172 Host: ad.lanjingke.com Connection: Keep-Alive User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4) \x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x00\x13d8\xc2\xc8\xc0olh`df\x00\x07\xbc\x0c,\x0c`\xc0dh\xc6\xc4\xc0^\x9a\x97\x9d\x97_\x9e\xc7\xcc\xc0^\x9c\x92m \xc4,\x0cl\xba\xa6\x06\x06z\x06\xac0\x06\x1b\x03or~\xae^qJZz\xaa^yI%;\x03\xbf\x01*\xe0\x00\x9a\xc9\xd8v\x97\x93\x81\xd9P\xcf\x94\x1bl\xc1\x07\x1e\x06\xb6\xdc\xfc\xa4\xcc\x9cT>\x06\x05C\xa343\x13S3#\xd3\x944c\x13\x13\x93\xb4$\x03 \xcb<9\xd1$\xc9$\xc5\xc4\xdc\xd4\x9c\x9f\x81A\x00\xe2,A\x08%\xcc\xc0\x90\xc2\xc0 \x02\xe6\xa8\x01\x00\x98\x92\xd1\xf9\xc7\x00\x00\x00
http://alog.umeng.com/app_logs	POST /app_logs HTTP/1.1 X-Umeng-Sdk: Android/4.5 %E6%96%B0%E7%BC%96%E6%88%90%E8%AF%AD%E8%AF%8D%E5%85%B8%2F3.8+sdk%2F4.1.2+528447f4ffb4e4824a2fd1d1f0cd62 Content-Encoding: deflate Content-Length: 431 Host: alog.umeng.com Connection: Keep-Alive
http://api.map.baidu.com/geocoder?key=77da98761303bb11032ea661eba07077&output=json&location=37.421998333333335,-122.08400000000002	GET /geocoder?key=77da98761303bb11032ea661eba07077&output=json&location=37.421998333333335,-122.08400000000002 HTTP/1.1 Host: api.map.baidu.com Connection: Keep-Alive
http://api.cp.guiji.com/is/info.jsp	POST /is/info.jsp HTTP/1.1 Content-Length: 489 Content-Type: application/x-www-form-urlencoded Host: api.cp.guiji.com Connection: Keep-Alive
http://ad.lanjingke.com/lanjingke/iris.action?g=1	POST /lanjingke/iris.action?g=1 HTTP/1.1 Content-Length: 173 Host: ad.lanjingke.com Connection: Keep-Alive User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4) \x1f\x8b\x08\x00\x00\x00\x00\x00\x00\x00UMK\x0e\x82@\x14+\x1fA\xa3\x88D\x0f\xe0\xca\x9d\x93\x19x3,8\x8d0\x8c1\x08,\xd0\x10/\xe0\xc9\xbc\x86w\xf0\x08\x12\x8c&6i\xda.\xdaFxX\x08\x13\xc1c\xc5\x7f\x08\xe0\x02p\x00[(\x1b\xfe\xb5\xa9\x9a\xb6o\x1c\xf8\x9d\xae\xb2\x81.\xbc\xbd\xe4\x9c\xf1\xc9\xd7x\x08\x8a\xb6f\x9d6\xc7\x92\xf5\x97\x9b\x8f\x90\xffc:lZ\xf7\xe7\x0c\x8e`r>\x1e\xbc\x16\xf0\xea6?\x9d\xcb%\xb6"6\x8a\xa4\x8a\xa56 \x11\x99\x9c\x0f.-\x0e\x94\x93\xa6T\xa6!\xb0\x1a[\x88>\xb2\x064\xb0\x19\xc3\xee -i\x0e3\xc7\x00\x00\x00
http://api.cp.guiji.com/is/init.jsp	POST /is/init.jsp HTTP/1.1 Content-Length: 479 Content-Type: application/x-www-form-urlencoded Host: api.cp.guiji.com Connection: Keep-Alive
http://api.cp.guiji.com/is/init.jsp	POST /is/init.jsp HTTP/1.1 Content-Length: 529 Content-Type: application/x-www-form-urlencoded Host: api.cp.guiji.com Connection: Keep-Alive

Dynamic HTTP/HTTPS Requests

Volatility

Nothing to display.